Re: [TLS] key sizes in TLS.

["Dang, Quynh" <[e-mail]>]

For example, proposed ciphersuites in
http://tools.ietf.org/html/draft-mcgrew-tls-aes-ccm-ecc-06, it has
requirements for client certificate, see the paragraph below.


"The server's certificate MUST contain an ECDSA-capable public key,
      it MUST be signed with ECDSA, and it MUST use SHA-256, SHA-384, or
      SHA-512.  The Signature Algorithms extension (Section 7.4.1.4.1 of
      [RFC5246] <http://tools.ietf.org/html/rfc5246#section-7.4.1.4.1>)
MUST be used to indicate support of those signature and
      hash algorithms.  If a client certificate is used, the same
      conditions apply to it.  The acceptable choices of hashes and
      curves that can be used with each ciphersuite are detailed in
      Section 2.2".


However, in many other ciphersuites' specifications, there is no
requirement about what key size(s) (curve(s)) (in ECDSA) to sign the
client certificate.

Regards,
Quynh. 


On 6/11/13 6:12 AM, "Nikos Mavrogiannopoulos" <[e-mail]> wrote:

>On Mon, Jun 10, 2013 at 4:08 PM, Dang, Quynh <[e-mail]> wrote:
>
>> I don¹t know if it would make sense to specify (1) a method for which
>>the
>> client can use to let the server know what key size(s) (DSS or RSA and
>>DH)
>> are acceptable and (2) a method for which the server can let the client
>>know
>> what key size(s) is/are acceptable to the server for the client's
>> authentication.
>
>You are correct. That is an omission from the DHE key exchange in TLS.
>At least in gnutls it caused several connection failure issues once we
>required a DH group of more than 768 bits in the client.
>
>Overall my impression is that the DHE-based ciphersuites are pretty
>much neglected. There are also optimizations that could be done (e.g.,
>the server specifying the size of the generator's subgroup), but
>no-one ever bothered to update the protocol.
>
>> Even with some (or proposed) ECC-based cipher suites, there is similar
>>issue
>> about key sizes for client¹s authentication.
>
>Which ones do  you mean? The ECC-based ciphersuites (with named
>curves) have the size of the curve hard-coded so I have noticed no
>such issues there. In that aspect they are better than their DH
>counterparts. If you mean the ECC ciphersuites with explicit curves I
>think you should reconsider their usage [0].
>
>regards,
>Nikos
>
>[0]. 
>https://www.cosic.esat.kuleuven.be/publications/private/article-2216.pdf